GitHub Advisoryadvisory · Maven

GHSA-p99p-726h-c8v5 Apache juddi-client vulnerable to XML External Entity (XXE)

HIGH Published 2018-10-19 Modified 2022-09-14 Official page ↗
Aliases
CVE-2018-1307
Ecosystem
Maven
Packages
org.apache.juddi:juddi-client
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2020-06-16

Affected packages

• Maven org.apache.juddi:juddi-client: >= 3.2, < 3.3.5 → fixed in 3.3.5

Description

In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use 3.3.5.

Related

Alias · CVE (1)

  • CVE-2018-1307 In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References